[syslog-ng] Syslog-ng seems to be not parsing correctly if the PROGRAM macro parsing fails.

27 Jul 2009

      Hello all.

I am using syslog-ng v 2.0.5. 

However, I am gathering logs from the cisco catalyst switches,
but when I tried to use the PROGRAM macro it seems not be working properly.

In Cisco switches , there seems to be messages that program is not included
in the message that is sent from the device.

I would like to know how does syslog-ng parses the messages that does not have
the PROGRAM name included and what would happen if we use the PROGRAM macro
for these message.

Following is the proper message:

  Jul 27 13:17:11 l2swtich 128: %SYS-5-CONFIG_I: Configured from console by console
                           ****
                           There are logs that does not have this part.

Regards,
Yu Watanabe